Author: HackWatchit

In episode 425 of “Smashing Security”, Graham reveals how “Call of Duty: WWII” has been weaponised – allowing hackers to hijack your entire PC during online matches, thanks to ancient code and Microsoft’s Game Pass. Meanwhile, Carole digs into a con targeting the recently incarcerated, with scammers impersonating bail bond agents to fleece desperate families. All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault. Warning: This podcast may contain nuts, adult themes, and rude language. Hosts: Graham Cluley:  @grahamcluley.com  @[email protected] Carole Theriault:  @caroletheriault Episode links: Sponsored…

Microsoft is rolling out a new backup system in September for its Authenticator app on iOS, removing the requirement to use a Microsoft personal account to back up TOTP secrets and account names. Previously, the Microsoft Authenticator app required iOS users to sign in with a personal Microsoft Account to enable backups, regardless of whether they were using the app for personal or enterprise credentials. This created problems in enterprise environments where organizations often like to keep personal and corporate data separated. The new backup system will continue to use the signed-in iCloud account to store the backups, but no longer…

A survey by UK company Raidiam found that even as the use of APIs continues to growth, most organizations have woefully inadequate protections in place to safeguard the increasingly sensitive data the APIs carry, exposing them up cyberattacks. The post API Use is Growing Fast, but Security is Lacking: Raidiam appeared first on Security Boulevard.

In brief Pencil Finance has deployed $1 million in on-chain capital to fund student loans in the Philippines and Indonesia. The capital is split into senior and junior tranches, offering fixed and variable yields backed by repayments from education provider ErudiFi. The protocol runs via smart contracts on Arbitrum-based EDU Chain, marking what it dubs as a first-of-its-kind initiative in the education sector. Decentralized lending startup Pencil Finance said Wednesday it has deployed $1 million in on-chain student loans, with funds directed to borrowers in the Philippines and Indonesia as part of a broader push to expand education financing in…

Red Hat announced Red Hat Enterprise Linux for Business Developers to simplify access to the world’s leading enterprise Linux platform for business-focused development and testing scenarios. A new self-service offering through the Red Hat Developer Program, Red Hat Enterprise Linux for Business Developers helps business development teams build, test and iterate on applications more quickly and on the same platform that underpins production systems across the hybrid cloud at no cost. IT complexity continues to grow, especially as applications deployed across physical, virtual, cloud and edge sites intermingle with AI, cloud-native and virtualized workloads. Further compounding this difficulty is a…

If you want a job at McDonald’s today, there’s a good chance you’ll have to talk to Olivia. Olivia is not, in fact, a human being, but instead an AI chatbot that screens applicants, asks for their contact information and résumé, directs them to a personality test, and occasionally makes them “go insane” by repeatedly misunderstanding their most basic questions.Until last week, the platform that runs the Olivia chatbot, built by artificial intelligence software firm Paradox.ai, also suffered from absurdly basic security flaws. As a result, virtually any hacker could have accessed the records of every chat Olivia had ever…

Executive Summary In late 2024, Unit 42 researchers discovered an issue with Azure OpenAI’s Domain Name System (DNS) resolution logic that could have enabled cross-tenant data leaks and meddler-in-the-middle (MitM) attacks. This issue stemmed from a misconfiguration in how the Azure OpenAI API handled domain assignments, versus how the user interface (UI) handled them. While the UI required unique custom domain names for each OpenAI instance, the API did not have this requirement for one specific custom domain. This allowed multiple tenants to share the same custom domain, potentially resolving to an incorrect, untrusted external IP address. The risk posed…

Nippon Steel Solutions suffered a data breach following a zero-day attack Pierluigi Paganini July 09, 2025 Nippon Steel Solutions reported a data breach caused by hackers exploiting a zero-day vulnerability in their network equipment. Nippon Steel Solutions, a subsidiary of Japan’s Nippon Steel, disclosed a data breach, attackers exploited a zero-day vulnerability. The company provides cloud and cybersecurity services. On March 7, 2025, Nippon Steel Solutions detected suspicious server activity and isolated the impacted system. An investigation revealed a zero-day attack on network equipment led to unauthorized access and potential leaks of personal data belonging to customers, partners, and employees.…

The Foundation for Defense of Democracies (FDD) identified that revoking existing equipment authorizations is a national security imperative, which is essential to closing supply chain gaps in the Federal Communications Commission (FCC) Equipment Authorization Program. The move requires telecommunications and electronic devices legally marketed in or imported to the U.S. to receive certification. These authorizations allow indefinite importation, sale, and use of devices until explicitly revoked. “Effective February 6, 2023, this rule bans new equipment authorizations from Chinese companies, including Huawei, ZTE, and Hikvision. However, identical devices that received authorization before the effective date remain legal for sale, deployment, and…